Nginx Proxy Manager: Secure Homelab Reverse Proxy with SSL & Fail2ban (2026)

Executive Summary & Architecture Overview

As your homelab expands beyond a single server, managing port numbers (:8080, :8188, :3000, :9443) across multiple IP addresses becomes unmanageable and dangerous. Exposing services directly without automated SSL certificates compromises network credentials over local Wi-Fi and public networks.

Nginx Proxy Manager (NPM) provides an intuitive, web-based management interface on top of a battle-tested Nginx HTTP reverse proxy engine. It centralizes:

• Automated SSL certificate issuance and 90-day renewal via Let's Encrypt.
• Wildcard certificates via DNS-01 challenges (e.g. Cloudflare DNS).
• Granular Access Lists (IP whitelisting, HTTP basic authentication, multi-factor barriers).
• WebSocket streaming and exploit prevention filters.

+--------------------------------------------------------------------------+
|                             Internet / WAN                               |
+------------------------------------^-------------------------------------+
                                     | Single Ports 80 & 443
+------------------------------------v-------------------------------------+
|                      Nginx Proxy Manager Container                       |
|                      - Port 80 (HTTP -> HTTPS Redirect)                  |
|                      - Port 443 (TLS Termination / Let's Encrypt)       |
|                      - Port 81 (Protected Admin WebUI)                   |
+------------------------------------^-------------------------------------+
                                     | Internal Container Routing
      +------------------------------+-------------------------------+
      |                              |                               |
+-----v-------------+      +---------v----------+         +----------v-----+
| Nextcloud (:8080) |      | Open WebUI (:3000) |         | Vaultwarden(:80|
+-------------------+      +--------------------+         +----------------+

Technical Specifications & Requirements

Step 1: Directory Setup & Host Networking

Create an isolated directory for configuration data and Let's Encrypt certificates:

sudo mkdir -p /opt/npm/{data,letsencrypt} && \
cd /opt/npm && \
sudo chmod -R 750 /opt/npm

Step 2: Production-Grade docker compose.yaml

Save the following file as /opt/npm/compose.yaml (following modern Docker Compose Spec V2 without version:):

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    environment:
      - DISABLE_IPV6=true
    volumes:
      - /opt/npm/data:/data
      - /opt/npm/letsencrypt:/etc/letsencrypt
    networks:
      - npm-net

networks:
  npm-net:
    name: npm-net
    driver: bridge

Security Pro-Tip: Notice that the admin port is bound to 127.0.0.1:81:81. This ensures your admin panel is never exposed publicly to the internet. Access it via SSH port forwarding (ssh -L 8181:localhost:81 user@server) or Tailscale.

Start the proxy:

cd /opt/npm && docker compose up -d

Verify logs:

docker compose logs -f

Step 3: Initial Onboarding & Let's Encrypt Wildcard SSL

1. Open http://localhost:81 (or via SSH tunnel).
2. Default credentials:
   • Email: admin@example.com
   • Password: changeme
3. Immediately update your email address and create a strong password.

Configuring Wildcard SSL via Cloudflare DNS:

1. Navigate to SSL Certificates -> Add SSL Certificate -> Let's Encrypt.
2. Enter Domain Names: *.yourhomelab.net, yourhomelab.net.
3. Check Use a DNS Challenge.
4. Select Cloudflare as DNS Provider.
5. Provide your Cloudflare API Token (scoped to Zone.DNS:Edit).
6. Agree to Terms of Service and click Save. NPM will verify ownership and issue a wildcard certificate covering all subdomains with zero open port requirements.

Step 4: Adding a Proxy Host with Best Practices

1. Go to Dashboard -> Proxy Hosts -> Add Proxy Host.
2. Details Tab:
   • Domain: vault.yourhomelab.net
   • Scheme: http
   • Forward IP: IP address of your application host (e.g. 192.168.1.50).
   • Forward Port: Application port (e.g. 8088).
   • Enable: Block Common Exploits.
   • Enable: Websockets Support.
3. SSL Tab:
   • Select your wildcard certificate *.yourhomelab.net.
   • Enable: Force SSL.
   • Enable: HTTP/2 Support.
   • Enable: HSTS Enabled.
4. Click Save.

Step 5: Fail2ban Hardening Against Brute Force

Protect your proxy hosts by installing Fail2ban on the host:

sudo apt update && sudo apt install -y fail2ban

Create /etc/fail2ban/jail.d/npm.local:

[npm-auth]
enabled = true
port = http,https
filter = npm-auth
logpath = /opt/npm/data/logs/fallback_access.log
maxretry = 5
bantime = 1d
findtime = 10m

Step 6: Automated Backup & Recovery Script

Create /opt/npm/backup.sh:

#!/usr/bin/env bash
set -euo pipefail

BACKUP_DIR="/mnt/backups/npm"
DATE=$(date +"%Y%m%d_%H%M%S")

mkdir -p "\${BACKUP_DIR}"

tar -czf "\${BACKUP_DIR}/npm_backup_\${DATE}.tar.gz" -C /opt/npm data letsencrypt compose.yaml

find "\${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +30 -delete
echo "[✓] Nginx Proxy Manager backup finished."

Schedule daily at 3:30 AM:

chmod +x /opt/npm/backup.sh && \
(crontab -l 2>/dev/null; echo "30 3 * * * /opt/npm/backup.sh >> /var/log/npm-backup.log 2>&1") | crontab -

Step 7: Deep Troubleshooting Matrix

Step 8: Frequently Asked Questions (FAQ)

1. Why use Nginx Proxy Manager over Traefik or Caddy?

NPM provides an intuitive visual UI, immediate visibility into certificates, and instant access list controls ideal for users who prefer visual dashboards over complex YAML/labels syntax.

2. Can NPM route traffic to physical machines outside of Docker?

Yes. Enter the LAN IP address of any server, NAS, Proxmox hypervisor, or router in the Forward Hostname / IP field.

3. How do Access Lists work in NPM?

Access Lists let you create password barriers (HTTP Basic Auth) or restrict access strictly to specific IP ranges (e.g., your office or home VPN) before requests ever reach your underlying application.

4. How can I back up my certificates?

All private keys and certificates live in /opt/npm/letsencrypt. Backing up this directory guarantees you can restore your SSL configurations seamlessly on a new server.

5. Is Nginx Proxy Manager safe to expose publicly?

Yes, for ports 80 and 443. Keep admin port 81 private and bound to 127.0.0.1 as demonstrated in our compose file.